GHSA-5GX6-F2QQ-475F EGroupware Code Injection vulnerability

phpgwapi/js/fckeditor/editor/dialog/fckspellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands v...

Electron vulnerable to remote command execution

Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...

GHSA-7FV9-M79R-J9X8 Electron vulnerable to remote command execution

Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...

GHSA-XQ29-JCJ7-XG86 Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands

Unspecified vulnerability in the Webkit PDFs webkitpdf extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors...

Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands

Unspecified vulnerability in the Webkit PDFs webkitpdf extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors...

GHSA-RG6G-V4XM-G49Q News system (news) extension for TYPO3 vulnerable to SQL Injection

SQL injection vulnerability in the News system news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CoolURI extension for TYPO3 vulnerable to SQL Injection

SQL injection vulnerability in the CoolURI extension before 1.0.30 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

GHSA-RM3Q-QFRM-FRRV TeamPass arbitrary file upload vulnerability

An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in...

TeamPass arbitrary file upload vulnerability

An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in...

The vulnerability of the SetNTPserverSeting() function in D-Link DIR-823-Pro wireless router software allows a hacker to execute arbitrary commands.

The vulnerability of the SetNTPserverSeting function in D-Link DIR-823-Pro wireless routers’ software lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the systemtimetimezone paramet...

The vulnerability of the TELNET network protocol implementation in D-Link DIR-882 A1 wireless routers allows a hacker to execute arbitrary commands.

The vulnerability of the TELNET network protocol implementation in D-Link DIR-882A1 wireless routers’ microsoftware lies in the lack of measures taken to clean data at the operating level when processing symbolic links like /usr/bin/cli. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the HTTP interface implementation for Zyxell network interfaces allows attackers to execute arbitrary commands.

The vulnerability of the HTTP interface implementation for Zyxell network interfaces relates to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by introducing a specially crafted file...

Fidelis Network Deception 命令注入漏洞

Fidelis Network Deception is a security product from Fidelis USA, Inc. A command injection vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from the filename parameter of CommandPost when using the updatecheckfile value. Command injection exists, and an...

SMA100 post-authentication Remote Command Execution vulnerability

Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Command as a 'root' user which potentially leads to remote command execution vulnerability or denial of service DoS attack.IMPORTANT: SMA 100...

CVE-2021-42897

A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...

CVE-2021-42897

A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...

CVE-2021-42897

A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...

CVE-2021-42897

A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...

FeMiner wms 操作系统命令注入漏洞

FeMiner wms is a repository management system for individual developers of Front End Miner FeMiner in China. FeMiner wms version 1.0 suffers from an operating system command injection vulnerability that stems from a Remote Command Execution RCE vulnerability found in /wms/src/system/datarec.php...

Zyxel Firewall ZTP Unauthenticated Command Injection Exploit

This Metasploit module exploits CVE-2022-30525, an unauthenticated remote command injection vulnerability affecting Zyxel firewalls with zero touch provisioning ZTP support. By sending a malicious setWanPortSt command containing an mtu field with a crafted OS command to the /ztp/cgi-bin/handler...